The _asn1_extract_der_octet function in lib/decoding.c in GNU Libtasn1 before 4.5 allows remote attackers to cause a denial of service (out-of-bounds heap read) via a crafted certificate.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - libtasn1: stack overflow in asn1_der_decoding (CVE-2015-2806)

  - libtasn1: Stack-based buffer overflow in asn1_find_node() (CVE-2017-6891)

  - libtasn1: Infinite loop in _asn1_expand_object_id(ptree) leads to memory exhaustion (CVE-2018-1000654)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

According to the versions of the libtasn1 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A heap-based buffer overflow flaw was found in the way     the libtasn1 library decoded certain DER-encoded     inputs. A specially crafted DER-encoded input could     cause an application using libtasn1 to perform an     invalid read, causing the application to crash.
    (CVE-2015-3622)

  - A stack-based buffer overflow was found in the way     libtasn1 decoded certain DER encoded data. An attacker     could use this flaw to crash an application using the     libtasn1 library. (CVE-2015-2806)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for libtasn1 is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Libtasn1 is a library that provides Abstract Syntax Notation One (ASN.1, as specified by the X.680 ITU-T recommendation) parsing and structures management, and Distinguished Encoding Rules (DER, as per X.690) encoding and decoding functions.

The following packages have been upgraded to a later upstream version:
libtasn1 (4.10). (BZ#1360639)

Security Fix(es) :

* A heap-based buffer overflow flaw was found in the way the libtasn1 library decoded certain DER-encoded inputs. A specially crafted DER-encoded input could cause an application using libtasn1 to perform an invalid read, causing the application to crash. (CVE-2015-3622)

* A stack-based buffer overflow was found in the way libtasn1 decoded certain DER encoded data. An attacker could use this flaw to crash an application using the libtasn1 library. (CVE-2015-2806)

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.4 Release Notes linked from the References section.

The following packages have been upgraded to a later upstream version:
libtasn1 (4.10).

Security Fix(es) :

  - A heap-based buffer overflow flaw was found in the way     the libtasn1 library decoded certain DER-encoded inputs.
    A specially crafted DER- encoded input could cause an     application using libtasn1 to perform an invalid read,     causing the application to crash. (CVE-2015-3622)

  - A stack-based buffer overflow was found in the way     libtasn1 decoded certain DER encoded data. An attacker     could use this flaw to crash an application using the     libtasn1 library. (CVE-2015-2806)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-1860 advisory.

    [4.10-1]
    - Updated to the 4.x branch (#1360639)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:1860 advisory.

    Libtasn1 is a library that provides Abstract Syntax Notation One (ASN.1, as specified by the X.680 ITU-T     recommendation) parsing and structures management, and Distinguished Encoding Rules (DER, as per X.690)     encoding and decoding functions.

    The following packages have been upgraded to a later upstream version: libtasn1 (4.10). (BZ#1360639)

    Security Fix(es):

    * A heap-based buffer overflow flaw was found in the way the libtasn1 library decoded certain DER-encoded     inputs. A specially crafted DER-encoded input could cause an application using libtasn1 to perform an     invalid read, causing the application to crash. (CVE-2015-3622)

    * A stack-based buffer overflow was found in the way libtasn1 decoded certain DER encoded data. An     attacker could use this flaw to crash an application using the libtasn1 library. (CVE-2015-2806)

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.4 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for libtasn1 fixes the following issues :

  - Malformed asn1 definitions could have caused a     segmentation fault in the asn1 definition parser     (bsc#961491)

  - CVE-2015-3622: Fixed invalid read in octet string     decoding (bsc#929414)

  - CVE-2016-4008: Fixed infinite loop while parsing DER     certificates (bsc#982779)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libtasn1 fixes the following issues :

  - Malformed asn1 definitions could have caused a     segmentation fault in the asn1 definition parser     (bsc#961491)

  - CVE-2015-3622: Fixed invalid read in octet string     decoding (bsc#929414)

  - CVE-2016-4008: Fixed infinite loop while parsing DER     certificates (bsc#982779)

This update was imported from the SUSE:SLE-12:Update update project.

This update for libtasn1 fixes the following issues :

  - Malformed asn1 definitions could have caused a     segmentation fault in the asn1 definition parser     (bsc#961491)

  - CVE-2015-3622: Fixed invalid read in octet string     decoding (bsc#929414)

  - CVE-2016-4008: Fixed infinite loop while parsing DER     certificates (bsc#982779)

The remote host is affected by the vulnerability described in GLSA-201509-04 (libtasn1: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in libtasn1. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, or cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

gnutls was updated to fix several security vulnerabilities.

  - fix double free in certificate DN decoding     (GNUTLS-SA-2015-3)(bsc#941794,CVE-2015-6251)

  - fix invalid read in octet string in bundled libtasn1     (bsc#929414,CVE-2015-3622)

  - fix ServerKeyExchange signature issue     (GNUTLS-SA-2015-2)(bsc#929690)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- fix for CVE-2015-3622 in bundled libtasn1 (bsc#929414)

  - invalid read in octet string

  - added gnutls-CVE-2015-3622.patch

  - fix for GNUTLS-SA-2015-2 (bsc#929690)

  - ServerKeyExchange signature issue

  - added gnutls-GNUTLS-SA-2015-2.patch

Update to 4.5 (#1217282)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-2604-1 advisory.

    Hanno Bck discovered that Libtasn1 incorrectly handled certain ASN.1 data. A remote attacker could     possibly exploit this with specially crafted ASN.1 data and cause applications using Libtasn1 to crash,     resulting in a denial of service, or possibly execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Updated libtasn1 packages fix security vulnerability :

A malformed certificate input could cause a heap overflow read in the DER decoding functions of Libtasn1. The heap overflow happens in the function _asn1_extract_der_octet() (CVE-2015-3622).

Hanno Boeck discovered a heap-based buffer overflow flaw in the way Libtasn1, a library to manage ASN.1 structures, decoded certain DER-encoded input. A specially crafted DER-encoded input could cause an application using the Libtasn1 library to crash, or potentially to execute arbitrary code.

ID	Name	Product	Family	Severity
198810	RHEL 6 : libtasn1 (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
103010	EulerOS 2.0 SP2 : libtasn1 (EulerOS-SA-2017-1172)	Nessus	Huawei Local Security Checks	critical
103009	EulerOS 2.0 SP1 : libtasn1 (EulerOS-SA-2017-1171)	Nessus	Huawei Local Security Checks	critical
102739	CentOS 7 : libtasn1 (CESA-2017:1860)	Nessus	CentOS Local Security Checks	critical
102647	Scientific Linux Security Update : libtasn1 on SL7.x x86_64 (20170801)	Nessus	Scientific Linux Local Security Checks	critical
102285	Oracle Linux 7 : libtasn1 (ELSA-2017-1860)	Nessus	Oracle Linux Local Security Checks	medium
102146	RHEL 7 : libtasn1 (RHSA-2017:1860)	Nessus	Red Hat Local Security Checks	medium
93152	SUSE SLED12 / SLES12 Security Update : libtasn1 (SUSE-SU-2016:1601-1)	Nessus	SuSE Local Security Checks	medium
93151	SUSE SLES11 Security Update : libtasn1 (SUSE-SU-2016:1600-1)	Nessus	SuSE Local Security Checks	medium
91868	openSUSE Security Update : libtasn1 (openSUSE-2016-773)	Nessus	SuSE Local Security Checks	medium
91619	openSUSE Security Update : libtasn1 (openSUSE-2016-716)	Nessus	SuSE Local Security Checks	medium
86135	GLSA-201509-04 : libtasn1: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
85901	SUSE SLED12 / SLES12 Security Update : gnutls (SUSE-SU-2015:1518-1)	Nessus	SuSE Local Security Checks	medium
85371	openSUSE Security Update : gnutls (openSUSE-2015-542)	Nessus	SuSE Local Security Checks	medium
83550	Fedora 21 : libtasn1-4.5-1.fc21 (2015-7288)	Nessus	Fedora Local Security Checks	medium
83344	Ubuntu 14.04 LTS : Libtasn1 vulnerability (USN-2604-1)	Nessus	Ubuntu Local Security Checks	medium
83329	Mandriva Linux Security Advisory : libtasn1 (MDVSA-2015:232)	Nessus	Mandriva Local Security Checks	medium
83308	Debian DSA-3256-1 : libtasn1-6 - security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2015-3622

medium

Tenable Plugins

high

critical

critical

critical

critical

medium

medium

medium

medium

medium

medium

critical

medium

medium

medium

medium

medium

medium